vmmon: avoid kernel writes to eventfd

Starting with mainline commit 4d03e3cc5982 ("fs: don't allow kernel reads
and writes without iter ops") in 5.10-rc1, kernel writes are only allowed
for files providing ->write_iter() callback which eventfd does not.

As an attempt to address this issue on kernel side by providing
->write_iter() callback to eventfd was met with a pushback and it's not
clear if there is a chance for it to be accepted, let's use a specific
eventfd interface eventfd_signal() instead. However, as the comments in
HostIF_SemaphoreSignal() indicate that the file descriptor may also be
a pipe (without telling when), let's keep kernel_write() as a fallback
in case the file descriptor is not eventfd.

Signed-off-by: Michal Kubecek <mkubecek@suse.cz>

vmmon-only/common/crosspage.c

@@ -51,7 +51,9 @@
  * linux/frame.h dates back to 4.6-rc1, we need the STACK_FRAME_NON_STANDARD
  * definition from it which is there from the start.
  */
-#   if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 6, 0)
+#   if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0)
+#      include <linux/objtool.h>
+#   elif LINUX_VERSION_CODE >= KERNEL_VERSION(4, 6, 0)
 #      include <linux/frame.h>
 #   endif
 #endif

vmmon-only/include/compat_poll.h

@@ -0,0 +1,30 @@
+#ifndef __COMPAT_POLL_H__
+#define __COMPAT_POLL_H__
+
+#include <linux/poll.h>
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 18, 0))
+
+#ifndef __poll_t
+typedef unsigned int __poll_t;
+#endif
+
+static inline __poll_t compat_vfs_poll(struct file *file,
+				       struct poll_table_struct *pt)
+{
+	if (unlikely(!file->f_op->poll))
+		return DEFAULT_POLLMASK;
+	return file->f_op->poll(file, pt);
+}
+
+#else
+
+static inline __poll_t compat_vfs_poll(struct file *file,
+				       struct poll_table_struct *pt)
+{
+	return vfs_poll(file, pt);
+}
+
+#endif
+
+#endif /* __COMPAT_POLL_H__ */

vmmon-only/include/x86msr.h

@@ -125,8 +125,12 @@ MSRQuery;
 #define MSR_PL3_SSP                          0x6a7
 #define MSR_ISST_ADDR                        0x6a8
 
+#ifndef MSR_TEST_CTRL
 #define MSR_TEST_CTRL                        0x33
+#endif
+#ifndef MSR_TEST_CTRL_SPLIT_LOCK_DETECT
 #define MSR_TEST_CTRL_SPLIT_LOCK_DETECT           (1ULL << 29)
+#endif
 
 #define IA32_MSR_ARCH_CAPABILITIES           0x10a
 #define MSR_ARCH_CAPABILITIES_RDCL_NO             (1ULL << 0)
@@ -663,7 +667,9 @@ MSRQuery;
 #define MSR_HYPERV_GUESTOSID_OS_WINNT_DERIVATIVE 4ULL
 
 /* MSR for forcing RTM abort to recover PMC3 (see PR 2333817) */
+#ifndef MSR_TSX_FORCE_ABORT
 #define MSR_TSX_FORCE_ABORT                      0x0000010f
+#endif
 #define MSR_TSX_FORCE_ABORT_RTM_BIT_INDEX        0
 
 /*

vmmon-only/linux/hostif.c

@@ -48,12 +48,14 @@
 #include <asm/io.h>
 #include <asm/page.h>
 #include <asm/uaccess.h>
+#include <asm/irq_vectors.h>
 #include <linux/capability.h>
 #include <linux/kthread.h>
 #include <linux/wait.h>
 #include <linux/hrtimer.h>
 #include <linux/signal.h>
 #include <linux/taskstats_kern.h> // For linux/sched/signal.h without version check
+#include <linux/eventfd.h>
 
 #include "vmware.h"
 #include "x86apic.h"
@@ -76,6 +78,7 @@
 
 #include "pgtbl.h"
 #include "versioned_atomic.h"
+#include "compat_poll.h"
 
 #if !defined(CONFIG_HIGH_RES_TIMERS)
 #error CONFIG_HIGH_RES_TIMERS required for acceptable performance
@@ -2328,6 +2331,27 @@ HostIF_VMLockIsHeld(VMDriver *vm) // IN
 
 #if defined(CONFIG_SMP) || defined(CONFIG_X86_UP_IOAPIC) || \
     defined(CONFIG_X86_UP_APIC) || defined(CONFIG_X86_LOCAL_APIC)
+
+#if COMPAT_LINUX_VERSION_CHECK_LT(5, 8, 0)
+static long compat_copy_from_kernel_nofault(void *dst, VA src, size_t size)
+{
+   mm_segment_t old_fs;
+   long ret;
+
+   old_fs = get_fs();
+   set_fs(KERNEL_DS);
+   ret = HostIF_CopyFromUser(dst, src, size);
+   set_fs(old_fs);
+
+   return ret;
+}
+#else
+static long compat_copy_from_kernel_nofault(void *dst, VA src, size_t size)
+{
+   return copy_from_kernel_nofault(dst, (const void *)src, size);
+}
+#endif
+
 /*
  *----------------------------------------------------------------------
  *
@@ -2347,15 +2371,11 @@ HostIF_VMLockIsHeld(VMDriver *vm) // IN
 static Bool
 isVAReadable(VA r)  // IN:
 {
-   mm_segment_t old_fs;
    uint32 dummy;
-   int ret;
+   long ret;
 
-   old_fs = get_fs();
-   set_fs(KERNEL_DS);
    r = APICR_TO_ADDR(r, APICR_VERSION);
-   ret = HostIF_CopyFromUser(&dummy, r, sizeof dummy);
-   set_fs(old_fs);
+   ret = compat_copy_from_kernel_nofault(&dummy, r, sizeof(dummy));
 
    return ret == 0;
 }
@@ -2553,7 +2573,7 @@ HostIF_SemaphoreWait(VMDriver *vm,   // IN:
 
    poll_initwait(&table);
    current->state = TASK_INTERRUPTIBLE;
-   mask = file->f_op->poll(file, &table.pt);
+   mask = compat_vfs_poll(file, &table.pt);
    if (!(mask & (POLLIN | POLLERR | POLLHUP))) {
       vm->vmhost->vcpuSemaTask[vcpuid] = current;
       schedule_timeout(timeoutms * HZ / 1000);  // convert to Hz
@@ -2668,6 +2688,7 @@ HostIF_SemaphoreForceWakeup(VMDriver *vm,       // IN:
 int
 HostIF_SemaphoreSignal(uint64 *args)  // IN:
 {
+   struct eventfd_ctx *eventfd;
    struct file *file;
    int res;
    int signalFD = args[1];
@@ -2678,6 +2699,17 @@ HostIF_SemaphoreSignal(uint64 *args)  // IN:
       return MX_WAITERROR;
    }
 
+   /*
+    * If it's eventfd, use specific eventfd interface as kernel writes
+    * to eventfd may not be allowed in kernel 5.10 and later.
+    */
+   eventfd = eventfd_ctx_fileget(file);
+   if (!IS_ERR(eventfd)) {
+      eventfd_signal(eventfd, 1);
+      fput(file);
+      return MX_WAITNORMAL;
+   }
+
    /*
     * Always write sizeof(uint64) bytes. This works fine for eventfd and
     * pipes. The data written is formatted to make an eventfd happy should
@@ -3241,12 +3273,9 @@ static int
 HostIFFastClockThread(void *unused)  // IN:
 {
    int res;
-   mm_segment_t oldFS;
    unsigned int rate = 0;
    unsigned int prevRate = 0;
 
-   oldFS = get_fs();
-   set_fs(KERNEL_DS);
    allow_signal(SIGKILL);
 
    while ((rate = linuxState.fastClockRate) > MIN_RATE) {
@@ -3269,8 +3298,6 @@ HostIFFastClockThread(void *unused)  // IN:
    }
 
  out:
-   set_fs(oldFS);
-
    /*
     * Do not exit thread until we are told to do so.
     */

vmnet-only/bridge.c

@@ -66,7 +66,7 @@
 #endif
 
 #if LOGLEVEL >= 4
-static struct timeval vnetTime;
+static u64 vnetTime;
 #endif
 
 typedef struct VNetBridge VNetBridge;
@@ -693,7 +693,7 @@ VNetBridgeReceiveFromVNet(VNetJack        *this, // IN: jack
 
 	 netif_rx_ni(clone);
 #	 if LOGLEVEL >= 4
-	 do_gettimeofday(&vnetTime);
+	 vnetTime = ktime_get_ns();
 #	 endif
       }
    }
@@ -1490,12 +1490,11 @@ VNetBridgeReceiveFromDev(struct sk_buff *skb,         // IN: packet to receive
 
 #  if LOGLEVEL >= 4
    {
-      struct timeval now;
-      do_gettimeofday(&now);
+      u64 now;
+
+      now = ktime_get_ns();
       LOG(3, (KERN_DEBUG "bridge-%s: time %d\n",
-	      bridge->name,
-	      (int)((now.tv_sec * 1000000 + now.tv_usec)
-                    - (vnetTime.tv_sec * 1000000 + vnetTime.tv_usec))));
+	      bridge->name, (int)((now - vnetTime) / NSEC_PER_USEC)));
    }
 #  endif
 

vmnet-only/userif.c

@@ -87,6 +87,24 @@ extern unsigned int  vnet_max_qlen;
 #   define skb_frag_off(frag) (frag)->page_offset
 #endif
 
+#if COMPAT_LINUX_VERSION_CHECK_LT(5, 10, 0)
+static inline
+__wsum compat_csum_and_copy_to_user(const void *src, void __user *dst, int len)
+{
+	int err;
+	__wsum ret;
+
+	ret = csum_and_copy_to_user(src, dst, len, 0, &err);
+	return err ? 0 : ret;
+}
+#else
+static inline
+__wsum compat_csum_and_copy_to_user(const void *src, void __user *dst, int len)
+{
+	return csum_and_copy_to_user(src, dst, len);
+}
+#endif
+
 /*
  *-----------------------------------------------------------------------------
  *
@@ -548,7 +566,6 @@ VNetCsumCopyDatagram(const struct sk_buff *skb,	// IN: skb to copy
 		     char *buf)			// OUT: where to copy data
 {
    unsigned int csum;
-   int err = 0;
    int len = skb_headlen(skb) - offset;
    char *curr = buf;
    const skb_frag_t *frag;
@@ -561,10 +578,9 @@ VNetCsumCopyDatagram(const struct sk_buff *skb,	// IN: skb to copy
       return -EINVAL;
    }
 
-   csum = csum_and_copy_to_user(skb->data + offset, curr, len, 0, &err);
-   if (err) {
-      return err;
-   }
+   csum = compat_csum_and_copy_to_user(skb->data + offset, curr, len);
+   if (!csum)
+	   return -EFAULT;
    curr += len;
 
    for (frag = skb_shinfo(skb)->frags;
@@ -575,13 +591,12 @@ VNetCsumCopyDatagram(const struct sk_buff *skb,	// IN: skb to copy
 	 const void *vaddr;
 
 	 vaddr = kmap(skb_frag_page(frag));
-	 tmpCsum = csum_and_copy_to_user(vaddr + skb_frag_off(frag),
-					 curr, skb_frag_size(frag), 0, &err);
+	 tmpCsum = compat_csum_and_copy_to_user(vaddr + skb_frag_off(frag),
+						curr, skb_frag_size(frag));
 	 kunmap(skb_frag_page(frag));
 
-	 if (err) {
-	    return err;
-	 }
+	 if (!tmpCsum)
+		 return -EFAULT;
 	 csum = csum_block_add(csum, tmpCsum, curr - buf);
 	 curr += skb_frag_size(frag);
       }